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(54) Tide: INdPLICIT CERTIHCATE SCHEME 

(57) Abstract 

A method of generating a public key in a 
secure digital communication system, having at least 
one trusted entity CA and subscriber entities A, the 
method comprising the steps of for each entity A, the 
CA selecting a unique identity Ia distinguishing the 
entity A; generating a public key reconstruction public 
data 7 A of entity A by mathematically combining a 
generator of the trusted pany CA with a private value 
of the entity A, such that the pair (U, 7a) serves 
as A's implicit certificate; combining the implicit 
certificate information (U, 7a) in accordance with a 
mathenialical function F(7a. Ia) to derive an entity 
information / generating a private key (a) of the entity 
A by signing the entity information / and transmitting 
the private key (a) to the entity A, whereby the 
entity A's public key may be reconstructed from 
the public information, the generator 7a and the 
identity Ia relatively efficiently. A further aspect 
of the invention provides for a public key certificate 
including a plurality of public keys, and wherein at 
least one of the public keys is an implicitly certified 
public key. 
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IMPLICIT CERTinCATE SCHEME 



This invention relates to key distribution schemes for transfer and authentication of 
encryption keys. 

5 

BACKGROUND OF THE INVENTION 

Diffie-Heliman key agreement provided the first practical solution to the key 
distribution problem, in cryptographic systems. The key agreement protocol allowed two 
10 parties never having met in advance or shared key material to establish a shared secret by 
exchanging messages over an open (unsecured) channel. The security rests on the 
intractability of the Diffie-Hellman problem and the related problem of computing discrete 
logarithms. 

With the advent of the Internet and such like the requirement for large-scale 
1 5 distribution of public keys and public key certificates are becoming increasingly important. 
Public-key certificates are a vehicle by which public keys may be stored, distributed or 
forwarded over unsecured media without danger of undetectable manipulation. The objective 
is to make one parties' public key available to others such that its authenticity and validity arc 
Verifiable. 

20 A public-key certificate is a data structure consisting of a data part and a signature 

part. The data part contains cleartext data including as a minimum, public key and a string 
identifymg the party to be associated therewith. The signature part consists of the digital 
signature of a certification authority (CA) over the data part, thereby binding the entities 
identity to the specified public key. The CA is a trusted third party whose signature on the 

25 certificate vouches for the authenticity of the public key bound to the subject entity. 

Identity-based systems (ID-based system) resemble ordinary public-key systems, 
involving a private transformation and a public transformation, but parties do not have 
explicit public keys as before. Instead, the public key is effectively replaced by a party's 
publicly available identity information (e.g. name or network address). Any publicly 

30 available information, which uniquely identifies the party and can be undeniably associated 
with the pany, may serve as identity information. 

An alternate approach to distributing public keys involves implicitly certified public 
keys. Here explicit user public keys exist, but they must be reconstructed rather than 
transported by public-key certificates as in certificate based systems. Thus implicitly 
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certified public keys may be used as an alternative means for distributing public keys(e.g. 
Diffie-Hcllman keys). 

An example of an implicitly certified public key mechanism is known as'Gunther's 
5 implicitly-certified (ID-based) public key method. In this method: 

1 . A trusted server T selects an appropriate fixed public prime p and generator a of 

. T selects a random integer t, with 1 < t ^ p-2 and gcd(t, p-1) = 1, as its 

private key, and publishes its public key u = mod p, along with a, p. 

2. T assigns to each party A a unique name or identifying string Ia and a random 
10 integer kA with gcd(kA, p-1) =1 . T then computes = a^-" mod p . Pa is A's 

BCEY reconstruction public data, allowing other parties to compute (Pa)® below. 

3. Using a suitable hash function h, T solves the following equation for a: 

H(lA) = t.PA+kAa(modp.l) 

4. T securely transmits to A the pair (r,s) = (Pa, a), which is T's ElGamal signature 
1 5 on Ia. (a is A's private key for Diffie-Hellman key-agreement) 

5. Any other party can then reconstruct A's DifFie-Hellman public key entirely 
ftom publicly available information (a, U. u. Pa, p) by computing; 

pa ^a^^h)^'PA^Q^p 

Thus for discrete logarithm problems, signing a certificate needs one exponentiation 
20 operation, but reconstructing the ID-based implicitly-verifiable public key needs two 
exponentiations. It is known that exponentiation in the group Z* and its analog scalar 

multiplication of a point in E(Fq) is computationally intensive. For example an RSA scheme 
is extremely slow compared to elliptic curve systems. However despite the resounding 
efficiency of EC systems over RSA type systems this is still a problem particularly for 
25 computing devices having limited computing power such as "smart cards", pagers and such 
like. 

SUMMARY OF THE INVENTION 

The present invention seeks to provide an efficient ID-based implicit certificate 
30 scheme, which provides improved computational speeds over existing schemes. For 
convenience, we describe the schemes over Zp, however these schemes are equally 
implementable in elliptic curve cryptosystems. 



-2- 

SUBSTITUTE SHEET (RULE 26) 



wo 99/49612 PCT/CA99/00244 

In accordance with this invention there is provided a method of generating an 
identity-based public key in a secure digital communication system, having at least one 
trusted entity CA and subscriber entities A, the method comprising the steps of: 

(a) for each entity A, the CA selecting a unique identity Ia distinguishing the 
5 entity A; 

(b) generating a public key reconstruction public data of entity A by 
mathematically combining a generator of the trusted party CA with a private value of 
the entity A, such that the pair (U, ) serves as A's implicit certificate; 

(c) combining the implicit certificate infonnation (U, /a ) accordance with a 
10 mathematical function , Ia) to derive an entity infonnation /; 

(d) generating a private key a of the entity A by signing the entity information / 
and 

transmitting the private key a to the entity A, whereby the entity A's public key may 
be reconstructed from the public information, the generator ^® identity Ia 

1 5 relatively efficiently. 

In accordance with a further embodiment of the invention there is provided a public 
key certificate comprising a plurality of public keys having different bit strengths and 
wherein one of the public keys is an implicitly certified public key. 

20 

BRIEF DESCRIPTION OF THE DRAWINGS 

Embodiments of the present invention will now be described by way of example only 
with reference to the accompanying drawings in which: - 

Figure 1 is a schematic representation of a first system configuration according to an 
25 embodiment of the present invention; and 

Figure 2 is a schematic representation of a second system configuration according to 
an embodiment in the present invention. 



30 

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT 

Referring to Figure 1, a system with implicitly-certified public keys is shown 
generally by 10. This system 10 includes a trusted third party CA and at least a pair of first 
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and second correspondents A and B respectively. The correspondents A and B exchange 
information over a communication channel and each includes a cryptographic unit for 
performing visual finding/verification and encryption/decryption. 

Referring back to Figure 1, the trusted party CA selects an appropriate prime p with 
5 p=tq+l where q is a large prime and a generator a of order q. The CA selects a random 
integer c, with 1^ c ^ q-1 as its private key, then computes the public key p=a*^ mod p and 
publishes (P,a, p, q). 
Scheme 1 : 

1 . For each party A, the CA choose a unique distinguished name or identity U 
10 (e.g., name, address, phone number), and a random integer Ca with 1< Ca < q- 

1. Then the CA computes yA=a^^ mod p. (ya is the party A's public key 
reconstruction public data. The pair (Ia, Ya) serves as A's implicit certificate) 

2. The CA selects a function /=F(Ia, 7a). For example, F(yA. Ia )= YA+h(lA), or 
F(Ya. Ia )=" h(YA+lA) where h is a secure hash function and solves the following 

15 equation for a, which is party A's private key. If a=0, then the CA chooses 

another Ca and re-solves the equation. 

1 = cf + CAa(mod q) 

3. The CA securely sends the triple (ya, a,lA) to A, which is CA's signature on Ia- 
Then 

20 a is A's private key; 

Ya is A's generator, and 

y^ (=a''^') is A's pubHc key. 

A publishes (a, U, P, Ya.P, q) in the public domain. 

4. Anyone can obtain party A's (ID-based) implicitly verifiable public key from 
25 the public domain by computing, 

=ap-'(modp), 

thus deriving the public key fi-om the above equation, which requires only one exponentiation 
operation. 

Although everyone can reconstruct party A's public key bom public data, this does 
30 not mean that the reconstructed public key y^ has been certified. This scheme is more 
effective when it is combined with an application protocol that shows that party A has 
complete knowledge of the corresponding private key. For example, with the MQV key- 
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agreement scheme or with any signature scheme and particularly with an KCDSA (Korean 
Certificate based Digital Signature Algorithm). In general, this implicit certificate scheme 
can be used with any scheme, which is required to verify the certificate. This may be 
demonstrated by referring to the Digital Signature Algorithm (DSA) signature scheme. 
5 Suppose Alice has a private key a, generator ya and publishes (a, Ia, P, Ya» Pt q) in 

public domain. Now Alice wants to sign a message M using DSA. 
Alice does the following: 

1. randomly chooses k, computes r=y ^ (mod p); 

2. computes e=sha-l (M); 

10 3. computes s=k"Ve + ar) (modp); 

4. The signature on M is (r,s). 
Verifier does the following: 

1 . gets Alice's public data (a, Ia, P, Yai P> q) ^d reconstructs the public 
key 

15 SA=Y^=aP'^(modp); 

2. computes e=sha- 1 (M); 

3. computes Ui = es** (mod q) and U2 = rs'^ (mod q); 

4. computes r ' = /J S**^ mod p ; 

5. if 1=^*, the signature is verified. At the same time Alice's (ID-based) 
20 public key is implicitly verified. 

The pair (Ia, Ya) serves as certificate of Alice. Reconstructing the public key serves as 
implicit verification when the application protocol results in a valid verification. Recall that 
obtaining the public key needs only one exponentiation operation. 

In an alternate embodiment, the scheme can be generalized to most ElGamal 
25 signature schemes by modifying the signing equation appropriately. In the following section, 
we give some examples. 
Scheme 2: 

The CA uses the signing equation l=ca+CA/ (mod q). The CA securely sends the 
triple (ya, a, Ia) to A, then a is A's private key, P is A's generator and P^ is A's public key. A 
30 publishes (a, Ia» p, Ya> P> q) in public domain. Anyone can obtain A's (ID-based) implicitly 
certified public key from the public domain by computing 

P*=aY/(mod p) 
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For this scheme, each user has the same generator P which is the CA's public key. 
Scheme 3: 

The CA uses the signing equation a = cf + ca (mod q). The CA securely sends 
the triple (ya, a, Ia) to A, then a is A's private key, a is A's generator and a' is A's public 
5 key. A publishes (a, Ia, P, Ya. p. q) in the public domain. Anyone can obtain A's (ID-based) 
implicitly certified public key from the public domain by computing 

a^'^pWmodp) 

For this scheme, each user including the CA has the same generator a. 
Scheme 4: 

10 The CA uses the signing equation a s + c (mod q). The CA securely sends 

the triple (ya, a, U) to A, then a is A's private key, a is A's generator and is A's public 
key. A publishes (a, U, P, Ya, P, q) in the public domain. Anyone can obtain A's (ID-based) 
implicitly certified public key from the public domain by computing 

a' = YiP (modp) 
1 5 For this scheme, each user including CA has same generator a. 

In the above schemes the user or party A does not have freedom to choose its own 
private key. The following schemes as illustrated in figure 2 both the CA and the user control 
the user's private key but only the user knows its private key. 

20 

Scheme 5': 

A first randomly chooses an integer k and computes a^, then sends it to the CA. The 
CA computes y^^ = or*^^ mod p , and solves the following signing equation for kA 
25 1 = cf + CAkA (mod q). 

Then the CA computes y\ - a^^ mod p and sends the triple (y , kA, U) to A, A 

computes a=kAk"' (mod q) and ya = (y I< )^(niod p). Then a is A's private key, ya is A's 
generator and y^ is A's public key. A publishes (a, U, P, Ya» P> q) in the public domain. 
Anyone can obtain A's (ID-based) implicitly certified public key from the public domain by 
30 computing Y!! =aP'*^(modp) 

Scheme 6: 
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1 . A randomly chooses an integer k and computes JS^ , then sends it to the CA. 

2. The CA randomly chooses an integer Ca , computes = /fa'''* (mod p) and f=F(yA Ja) . 
solves the signing equation for fc^ (if /r^=0. then choose another Ca) 

l = + (mod 9). 

5 Then CA computers y\ = (mod p) and sends the triple ( /\ ,kA, Ia) to A. 
Note: ,kA, Ia) can be sent by public channel. 

3. A computes = (ri)*''flr* (mod/?), /=F(/^ Ja) , and 0=*^-*/^ (mod g). (if 0=0,7, then 
goes back to step 1.). Then checks if ^ = a/^ . Now a is y4's private key, ^is A*s 
generator and ^''is A's public key. A publishes (<ar, , /? , p, ^) in the public 

10 domain. 

4. Anyone can obtain A 's (ID-based) implicitly certified public key from the public 
domain by computing 

= ay/ (mod/)) 

Scheme 7: 

A first randomly chooses an integer k and computes a^, then sends it to the CA. Now 
CA computes Ya = a^a^ (mod p), solves the signing equation for kA 

kA = cf + CA(mod q) 

Then the CA computes y = (a"^)^"^ (mod p) and sends the triple (y , kA, Ia) to A. A 

computes Ya = (y f '^ ol^ (mod p). Then a = kA+k (mod q) is A's private key, a is A*s 

generator and a" is A's public key. A publishes (a, Ia, P, Ya* p, q) in public domain. Anyone 
can obtain A's (ID-based) implicitly certified public key from the public domain by 
computing 

a' = pVA(mod p) 

Scheme 8: 

1. A randomly chooses an integer and computes then sends it to the C4. 

2. The CA randomly chooses an integer ca , computes = a^a'^ (mod p) and frFi/A Ja) » 
computes kA (if kA=0, then choose another ca) 

kA^ cjf-^ c (mod g). 
Then CA computers y\ = (a* (mod p) and sends the triple {y\ ,kA, Ia) to A. 
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Note: (/i ,kA, I a) can be sent by public channel. 
3. A computes = (/i/'V (mod;?), j^F{yA Ja) , and fl=*^+^ (mod q). (xia^OJ. then 
goes back to step 1.). Then checks if a" = r{j3. Now a is .4's private key, a isA's 
generator and a° is A's public key. A publishes {aJA.AXA, p, q) in public domain. 
5 4. Anyone can obtain A 's (ID-based) implicitly certified public key from the public 
domain by computing 

o^^rifi (mod;?) 

In the above schemes 5-8, anyone can get some partial infomiation of user /i's private 
10 key AT since Ha is sent by public channel. To hide this infomiation and to speed up 

computation of above schemes, we introduce DES encryption to get following scheme 9-12 
by modifying scheme 5-8. The advantages in scheme 9-12 is that user can compute K easily 
since >^is fixed. . 

15 Scheme 9: 

1 . A randomly chooses an integer k and computes Ok , then sends it to C4. 

2. CA randomly chooses an integer computes = a*'''^ (mod p) and / = FiyA, fi, ) 
, solves the signing equation for /:^(if *^=0, then choose another Q). 

1 = c/ + c^*^ (mod ?) 

20 Next CA computes K^{a^Y (mod p) and L = DES^ [k^ ), then sends the triple 
/a 

3. /4 computes ^ = /7*(modp),*^ ^DES^(kA\3nd a =k^k'' {mod q), (if a=U then goes 
back to step 1). Then checks if = a/J^^. Now a is ^'s private key, y^ is A's 
generator and is ^'s public key. A publishes (a, , A <l) in public domain. 

25 4. Anyone can obtain ^ 's (ID-based) implicitly certified public key from the public domain 
by computing 

r^^A^afi-Hmodp) 

Scheme 10: 
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1 . A randomly chooses an integer k and computes J^, then sends it to CA. 

2. CA randomly chooses an integer computes = jff^a^" (mod p) and 

/ = F{y^ , A ) > solves the signing equation for Ma (if =0, then choose another Ca. 

l = ck^ -hc^f (mod g) 

Next CA computes K^{fi^ = a^'' (mod /?) and A ^ = DES^^ (*^ ), then sends the triple 
(r^L,/^)to^. 

Note: (j^^kA,!^) can be sent by public channel. 

3. /I computes A- = (7^ =a*'^(modp),Jt^ ^ DES^(kA)J ^ F{y^,fiJ ^)zxiA 
computes a^k^-kf (mod q) . (if a-o,l , then goes back to step 1). Then checks if 

yff" = ay'/ . Now a is A's private key, is A's generator and fi" is A's public key. A 
publishes {a, I ^ , A » P» 9) ^ public domain. 

4. Anyone can obtain A's (ID-based) implicitly certified public key from the public domain 
by computing 

= or// (mod;?) 

Scheme 1 1 

1 . A randomly chooses an integer k and computes a* » then sends it to CA . 

2. CA randomly chooses an integer Ca, computes y^ = (mod p) and / = F{y^jfiJ^) 
computes (if /r^ = 0, then choose another Ca) 

=cf + c^(modg) . 

Next CA computes K = (a*)'' (mod p) and kA - DESf^ {k^ ), then sends the triple 
{y^,kAj^)toA. 

Note: (/'^j*^,/^) can be sent by public channel. 

3. A computes /T = (mod p),k^ = DES^^ (^^ ) , and a = + fc(mod q) (if a=0,l , then goes 
back to step 1). Then checks if a"* = J^^/a . Now a is A's private key, a is /4's generator 
and a* is A*s public key. A publishes (a, , A > P* 9) in public domain, 

4. Anyone can obtain A *s (ID-based) implicitly certified public key from the public domain 
by computing a" = y^{mod p) 
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Scheme 12: 

1. A randomly chooses an integer k and computes then sends it to CA. 

2. CA randomly chooses an integer Q, computes = a^a^^ (mod p) and 

/ = F(y^ ,>^,/^) computes kA (if A^=0, then choose another Ca) k^ = c^f + c(mod9) 
5 Next CA computes K-ia'^Y (mod p) and kx = DES^ {k^ ) , then sends the triple 
(j^JcAjJioA. 

Note: (/^ Jca J a) can be sent by public channel. 

3. y4 computes K = jff'' (mod p)yk^=DESj^ {k a) J ^F{/^,jffJJ,anda = k^+lf(modq). 
(if a=0,l, then goes back to step I). Then checks if a" = Now a is-4's private key, 

10 a is ^'s generator and a" is y4's public key. /4 publishes {flj j^^fi^y j^^p^q). Anyonecan 
obtain A's (ID-based) implicitly certified public key from the public domain by 
computing 

^''=r^Amod/?) 

The advantages for schemes 9-12 are that user A can compute K easily since p is fixed and 
1 5 that kA is encrypted such that no other people can know it. 

Note that for schemes 5-12, adding an option parameter OP to the function F(/^ ^PJA ) (i'^ » 

/ - F{y ^,fi,l^,OF)'m\\ make the schemes more useful. For example, OP = a"^ , whereof 

is user ^'s private encryption key and ar"^ is user A's public encryption key. Following 
20 scheme 15 is a modification of scheme 7. Schemes 5-12 can be modified in the same way. 
The schemes 1-4 can also be modified in the same way. 

Scheme 13: 

1. A randomly chooses an integer * and computes ^i^, then sends it to C4[. 
25 2. CA randomly chooses an integer ca , computes = a^a^* (mod p) and f= F{yA Ja» 
OP), computes (if kA=0, then choose another ca) 

kA^cf+CA (mod 9).. 
Next CA computers K - H{{a^Y) and ^^-DES/c(*^)> then sends the triple 
{f. k,jA) to A, 
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3. A computes K^H{fi^),kA =DESi^A^), and a=kji'^k (mod q) (if a=^0 J . then goes 
back to step I.) Then computes = a"^^ (mod p) and checks if / = F(yA Ja, OP). 
Now is private key, ^ is i4's generator and a" is public key. ^4 publishes (o^Ia. 
A }U»p,g)in public domain. 

5 4. Anyone can obtain ^'s (ID-based) implicitly certified public key from the public domain 
by computing 

a^'^fi^YA (modp) 
Furthermore we can reduce the bandwidth by following scheme 14. 

10 

Scheme 14: 

1 . A randomly chooses an integer k and computes ct^ then sends it to CA. 

2. CA randomly chooses an integer Ca , computes Ya -cc^^^^ (mod p) and set as the 
first 80 least significant bits of Ya • Then computes frF(YA Ja» OP) and kA (if kA-0, then 

1 5 choose another ca) 

kA^cf-^CA (modqr). 
Next CA computers K = (a^Y (mod p) and A^=DESa(Au), then sends the triple 

(Y,. kAJA)toA. 

Note: (Ya , k^jA) can be sent by public channel. 
20 3. A computes K^jf (mod /?), kA == DESjt(^^), and a^kA-^k (mod q) (if a=OJ, then 
goes back to step 1.) Then computes f= F(Ya»A>^a) , Ya = ^^"^ P"^ (mod p) and checks if 
the first 80 least significant bits of Ya 7 a • Now a is 's private key, a is ^ 's generator 

and a" is public key. A publishes (a. Ia . A 7a ,p. g) i^ public domain. 

4. Anyone can obtain A 's (ID-based) implicitly certified public key from the public 
25 domain by computing 

a'^P^YA (mod;7) 

The security level of scheme 5.c is not as other schemes we discuss before. Scheme 5.c only 
has 80 bit security. But it is OK for practical application Now. We can extend the first 80 
30 least significant bits to the half least significant bits of Ya • 
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The implicit certificate can be used to certify some other useful information by including the 
information in the option parameter OP. For example OP-a''^ WOPi^ where ag is user A's 
another private key and a'^is the corresponding public key. Following scheme IS is a 
modification of scheme 7. Other schemes can be modified in the same way. 

5 

Scheme IS: 

1 . A randomly chooses an integer qe and computes a""^ . 

2. A randomly chooses an integer k and computes a'^, then sends a*^ and a"^ to CA. 

3. CA randomly chooses an integer Ca, computes = a^a"""* (mod p) and 
10 / = F(/^,A/^,a'^). (for example, 

/ = F{y^,fi, l^.a''^ ) = Ky^ II >ff 11 II /ar*"* )) computes Jt^ (if Au=0, then choose another 
Ca) 

kj^^cf + Ci4(mod9) 
Then CA computes y\ = (or* (mod p) and sends the triple {y\,k^J A, 
1 5 Note: {y\,k^J^) can be sent by public channel. 

4. A computes a^kA+k (mod q). (if a=0,l, then goes back to step 1) and computes 

= y\ )* ' a* (mod p) . Then checks if a** = fi^/j^ . Now a is ^'s private signing key, 
a is i4 *s generator and a" is A 's public signing key, ae is A *s private encryption key and 
is A's public encryption key. A publishes ( (a, J ^,fi,y^, p, q) in public domain. 
20 S. Anyone can obtain y^'s (ID-based) implicitly certified public key firom the public domain 
by computing 

=>?^rw(mod/7) 
Notes: (for scheme 13-15) 

1 . The identity I a may be chosen either by CA or by entity A 
2S 2. CA should authenticate the entity It can be done by the method described in the note 2 
of scheme 11. 

3- iff k^jA)ox{y^ , k^jA)or(y\ .A,*. /^) can be sent by public channel. 

In our schemes, (a,y^ ) is CA's signature on A's ID it was supposed to be known by 
30 public. But now, only user A knows the a. So when we use these schemes, we should make 
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sure that in application protocol, us^iA knows his/her own private key. In other words, the 
application protocol must guarantee that A uses his/her private key in the computation. 

The security of the new scheme depends on the signing equations. For example, in 
scheme 1, the signing equation is 
5 l^cf-^CAO (mod 9). (1) 

We are going to show that for some choice of the one way function F(ya, /^), the new scheme 
1 is equivalent to DSA. 

Let's consider CA using DSA signing equation to sign\r4*s identity First CA 
randomly choose a ca and compute yA== a^"^ mod p, then CA uses a secure hash function h to 
10 computer finally CA solves following equation for s. 

KIa^^cyj^-^cas (mod 9). (2) 
Now (ya, s) is CA 's signature on/^. 
Multiply equation (2) by KIaY^ we got 

I ^ cya KIa)'^ + casHIa)'^ (mod q) 

15 

Let F(ya, Ia) = Ya KIa)'^ and replace sh(lA)'^ by a in above equation we got the equation (1). 
Obviously, equation (2) is equivalent to equation (1) if /'(Ya, Ya KW^- That means, if 
anyone can break the scheme using the signing equation (1), then he/she can break the 
scheme using the signing equation (2) which is DSA scheme. 

20 Heuristic arguments suggest our new schemes are secure for suitable choice of F(ya. 

Ia), where F(ya, Ia) = Ya IiGa) or F(ya, Ia) = h(YA, Ia). Note F(ya, Ia) can be some other 
format, for example when Ia is small, say 20 bits, but q is more than 1 80 bits, then we can use 
F{ya, IaMa + Ia. a disadvantage of the new schemes is all users and CA use the same field 
size. However this is the way that all HD-based implicitly certified public key schemes work, 

25 for example, Girault's RSA based DifSe-Hellman public key agreement scheme. 
A further set of schemes may also be described as follows: 

System setup: A trusted party CA selects an appropriate prime p with p-tq-^l where 
<7 is a large prime and a generator at of order q. CA selects a random integer c, with I<c<q 
as its private key, computes the pubUc key j3=cf^ mod p and publishes {fi, a,p, q). Then CA 
30 chooses a special cryptographic function f=F{yAJ/i,OP) (f: {ft/}* -> {7,2,. ..(^-7)}) such 
that with this function, the signature scheme which used to produce implicit certificate is 
secure, where OP represents some option parameters that user may concern (such as date, or 
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y^lhe CA's public key). For example, let A be a secure hash fiinction, f can be one of 
following format 

1. F{rAJA.oP)=rA'^fi^h{iA) 

2. F{rAJA.0P)^h{yA\\/3\\h) 

3. F{yA Ja .OP) -/a-^/^Fa where Ia has some pattern ( or when U is small, say 20 bits, and 
g is more than 180 bits) 

4. F{rAJA.OP)^rA'^h{lA) 

5. FirAJA.OP) =Atel|/^) 

6. F{yA Ja . OP) ~/a '^Ia where Ia has some pattern { or when U is small, say 20 bits, and g is 
more than 180 bits) 

7. It is very easy to change the parameters a little bit to get a secure signature scheme ftom 
a given secure signature scheme. So F{yA Ja»OP) can be any other fonnat that guarantee 
the signature scheme which used to produce implicit certificate is secure. Note that by 
suitable choosing F{/a J a .0P\ Any Elgamal-like signature scheme we know so far is 
equivalent to one of the 4 families schemes we proposed in this paper if it is used as 
implicit certificate scheme after modification. But our proposed schemes have the most 
efficiency. 

Note: the above system setup will be assumed in the following schemes. 
Scheme l.a: 

1. For each entity A, CA chooses a unique distinguished name or identity Ia (G g-» name, 
address, phone number), and a random integer ca with 1<ca < g . Then CA computes 
Xa = cr'^ mod p.(ju isA's public key reconstruction public data, {Ia , ju) serves as ^ ' s 
implicit certificate) 

2. CA computes f=F(/A Ja . OP) and solves the following equation for a (if fl=0,/,c. 
c'^^c , then chooses another ca and re-solve the equation). 

1 = c/* + c^a (mod q). 
3- CA securely sends the triple (ju , a Ia) to A, which is CA's signatiu-e on Ia. Then a is 
A*s private key, yA^sA's generator and (= a""*") is .4's public key. A publishes {a 

.lA,AjU.p.g) in public domain. 
4. Anyone can obtain A*s (ID-based) implicitly verified public key from the public 
domain by computing 

y^^ajr^ (mod/?) 
-14- 
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Note: 

1 . In step 1 , The identity may be chosen by entity A . 

2. In step 2, we exclude a=0, 7, since in this case any one can easily knowing /i's private 
key. Especially when a=0, c'^^c^ any one can compute CA's private key c from l=^cf 
(mod q). 

3. For this scheme, each user has different system generator ju- 

Scheme Lb: 

1. For each entity A, CA chooses a unique distinguished name or identity I4 (e.g., name, 
address, phone number), and a random integer ca with I<Ca< g - Then CA computes 
/A'^a'^ mod p^i/A isA's public key reconstruction public data. {I a , /a) serves as ^4' s 
implicit certificate) 

2. CA computes frF{yA J a , OP) and solves the following equation for a (if a=0,y,c, then 
chooses another ca and re-solve the equation). 

7 s ca+Cy/ (mod q). 

3. CA securely sends the triple (/a . a Ia) to A, which is CA's signature on Then a is 
A's private key, jSisA's generator and jS" isA's public key. A publishes (a, Ia,A /a 
, p, q) in public domain. 

4. Anyone can obtain i4's (ID-based) implicitly verified public key from the public 
domain by computing 

^ = ay'J (mod p) 

Note: 

1 . In step 1 , The identity I a may be chosen by entity A . 

2. In step 2, we exclude a=0,7, since in this case any one can easily knowing /i's private 
key. when a-0, the certificate does not involve to CA, 

3. For this scheme, each user has same system generator fi. 

Scheme l.c: 

1. For each entity A, CA chooses a unique distinguished name or identity Ia (e.g., name, 
address, phone number), and a random integer ca with 1< ca < q. Then CA computes 
/a- ot""^ mod /?. {xa is y4's public key reconstruction public data. {I a , yx) serves as i4' s 
implicit certificate) 
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2. CA computes frF{/A J a . OP) and solves the following equation for a {ifa-OJ or c , 
then chooses another ca and re-solve the equation). 

a scf-i-CA (mod q), 

3. CA securely sends the triple (xa , a h) to A, which is C4's signature on I a. Then a is 
5 A\ private key, ^aris A'^ generator and cF is ^'s public key. A publishes {a.lA^fi^rA 

,p,q)\n public domain. 

4. Anyone can obtain A"s (ID-based) implicitly verified public key from the public 
domain by computing 

a^'^P^YA (mod;?) 

10 Note: 

1 . In step 1 , The identity I a may be chosen by entity A . 

2. In step 2, we exclude a =0,7, since in this case any one can easily knowing A's 
private key. 

3. For this scheme, each user has same system generator a. 

15 

Scheme Ld: 

1. For each entity A, CA chooses a unique distinguished name or identity I a (e.g., name, 
address, phone number), and a random integer ca with l<CA<q ^ Then CA computes 
yA-ce^"" mod /?. {/a is A's public key reconstruction public data. {Ia , /a) serves as A' s 

20 implicit certificate) 

2. CA computes f='F(YA Ja . OP) and solves the following equation for a (if fl=0.7 or c , 
then chooses another ca and re-solve the equation). 

a scAf+c (mod q). 

3. CA securely sends the triple (ju . fl. Ia) to A, which is CA's signature on Ia^ Then a is 
25 A"s private key, a is i4's generator and cf is A' s pubHc key. A publishes {a.h, PTa 

, p, q) in public domain, 

4. Anyone can obtain A's (ID-based) implicitly verified public key firom the public 
domain by computing 

^'=ri^ (mod/?) 

30 Note: 

1 . In step 1 , The identity I a may be chosen by entity A . 
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15 



20 



25 



2. In step 2, we exclude a=OJ, since in this case any one can easily knowing A's 
private key. 

3. For this scheme, each user has same system generator a 

Although everyone can reconstruct user^^.'s public key from public data, this does not mean 
that the reconstructed public key has been certified. To explicitly verify the certificate, we 
need to know the a. Once we know the a, the verification process become to verify CA's 
signature on Ia. For example, In scheme l.a, if verifier computes aj^^ and user A computes 
using a, then they can verify the certificate together. But verifier must make sure that user 
A indeed knows a. So reconstructing public key serves as an implicit verification only if it 
combines with an application protocol that shows user A has a complete knowledge of the 
corresponding private key. In general, the implicit certificate scheme can be used with any 
public key scheme which needs to authenticate the subject entity and the public key. 

Let's demonstrate it by using DSA signature scheme as implicit certified public key system 
and scheme l.a as implicit certificate scheme. 

Suppose Alice has private key a, generator }u and publishes (o^ Ia . A /a , P. q) in public 
domain. Now Alice wants to sign a message M using DSA. 

Alice does following: 

1 . randomly chooses k, computes r = (mod p). 

2. computes e=sha-l (A/). 

3. computes s=jc"^(e + ar) (mod 

4. The signature on M is (r,^). 

Verifier does following 
1. gets Alice's public data {a,h. Aya,P. q) and computes /and reconsUncts the public 
key 



2. 



3. 



Pa^Y\^olI^^ (modp) 
computes e=sha-l(il^). 

computes w, = w'' (mod 9) and u^-rs'^ (mod 9) 
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4. computes r '= S"^ (mod p) 

5. if r=r', the signature is verified. At same time Alice's (ID-bases) public key is 
implicitly verified. 

5 The pair (7^ , y^) serves as certificate of Alice. For DSA, we know that it is very hard to 

forge Alice's signature without knowing a. Then reconstructing the public key serves as 
implicitly verification when the application protocol ends up with valid. Recall that 
obtaining the public key needs only one exponentiation operation. For this reason, we say that 
verifying the implicit certificate needs one exponentiation operation. 
10 The following implicit certificate schemes may be derived by modifying the schemes 

above such that CA and entity both control the entity's private key but only the subject entity 
knows his/her private key. 

In this section we need another system parameter ^/(*). where //(♦) is an cryptographic 
1 5 function which may be a secure hash function or one way function or identity map. 

Scheme 2.a: 

1. A randomly chooses an integer k and computes ct, then sends it to CA. 

2. CA randomly chooses an integer ca , computes = a**'" (mod/?) and/= F{yA Ja, OP), 
20 solves the signing equation for A:^ (if A:^=0 or c, then chooses another Ca) 

l = cf + c^k^ (mod 9). 

Then CA computers y\ = a'"* (modp) and sends the triple .UaJa) ^oA. 

3. A computes a^kAk"^ (mod q). (if a=^l, then goes back to step 1.) and computes 

= (/i)* (mod py Then checks if /° = a/^~^ . Now a is ^'s private key, /a is ^'s 
25 generator and is A 's public key. A publishes {a, Ia , /a ^ public domain. 

4. Anyone can obtain A *s (ID-based) implicitly certified public key from the public 
domain by computing 

y*"^ = afi-^ (mod/?) 

30 Scheme 2.b: 

5. A randomly chooses an integer ^ and computes , then sends it to C4. 
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6. CA randomly chooses an integer ca , computes = ^^a^"* (mod p) and f= F{yA Ja. 0P\ 
solves the signing equation for kA iyikA^O, c. then chooses another ca) 

l = c*, +c^/ (mod 9). 

Then CA computers y\ = {fi^Y"^ ' (mod p) and sends the triple {y\ ,kA, Ia) to A. 
5 1. A computes y^ = fi^ (mod p\ f=^F{yA J a , OP), and a ^ kA - kf (mod q), (if 
a-OJ, then goes back to step 1.). Then checks if ^ = ay'/ . Now a isy4's private key,^ 
fixsA^s generator and ^ is ^'s public key. A publishes (a, , /? , p, 9) in public 
domain. 

8. Anyone can obtain ^'s (ID-based) implicitly certified public key from the public 
1 0 domain by computing 

p'^ay'J (modp) 

Scheme 2.c: 

1 . A randomly chooses an integer k and computes then sends it to CA. 
15 1. CA randomly chooses an integer ca , computes = a* a'''' (mod/?) and/= F{ja Ja, OP), 
computes kA (if kA-c, then chooses another ca) 

kA ^cf^CA (mod^). 
Then CA computers y\ = (a* (mod p) and sends the triple {y\ ,kA, I a) to A. 

3. A computes a^kA^k (mod q). (if a=0,/, then goes back to step 1.) and computes 
20 y^ = {y\Y ' a* (mod /?). Then checks if a" = fi^y^ . Now a is ^'s private key, or is /I 's 

generator and or" is ^4 *s public key. A publishes (a , . /J , p, ^) in public domain. 

4. Anyone can obtain i^'s (ID-based) implicitly certified public key firom the public 
domain by computing 

flr-=>ffV^ (modp) 

25 

Scheme 2.d: 

1 . A randomly chooses an integer k and computes ot^ then sends it to CA. 

2. CA randomly chooses an integer ca , computes y^^ = a^a^* (mod p) and/= F{yA Ja» OP), 
computes kA (if kA-CA , then chooses another ca) 

30 kA ^ c^f-^c (mod 9). 
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Then CA computers = (a* (mod p) and sends the triple (/^ 1a) to ^4. 

3. A computes =(/i)* *^ (mod pi f=F(rA Ja , OP), and a=kA+kf (mod 9). (iffl=ft7, 

then goes back to step 1 Then checks if a" = j^^fi . Now a is ^4 's private key, cr is i4's 

generator and a° isA's pubhc key. A publishes (a, Ia, A /a , p. q) in public domain. 
5 4. Anyone can obtain A 's (ID-based) implicitly certified public key from the public 
domain by computing 

a^'^riP (rnodp) 

Notes: (for scheme 2.a,2.b,2.c,2.d) 

10 1 . The identity Ia may be chosen either by CA or by entity A 

2. CA should authenticate the entity A, It can be done either by presence in front of CA 
or by secure channel or by voice (for example, on the phone) or by following method: 
In step 2, instead of sending the triple (/^ ,kA^ Ia) to Ay CA first sends to A. A 
computes /a t set K-H(yA) , encrypts the authentication information Aai of A (such as 
15 VISA information) by DES (or other symmetric key system) and sends DESaK^^^/) to 

CA. CA decrypts the DESj^^^y) to get Aai . After checks the validity of ^4^/, CA then 
sends (^^./^) to 
3- {/a »^a. ^a) can be sent by public channel. 

20 In above scheme 2.a-2.d, The implicit certificate schemes are finished by the subject entity 
and the CA. Each scheme is essentially divided into two part: key-exchange part and 
signature part. One function of the key exchange part is to transmit implicit certificate 
infomiation from CA to A by public channel (more discuss will be given in section 6). To 
speed up computation of above schemes, we can modify the key exchange part. Following 

25 scheme 3.a-3.d by modifying scheme 2.a*2.d. The advantages in scheme 3.a-3.d is that user 
A can compute AT before he get respond from the CA since /7is fixed. This property is good 
especially for the online case. 

Scheme 3.a: 

30 I. A randomly chooses an integer k and computes t/, then sends it to CA. 
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2. CA randomly chooses an integer Ca , computes = a^^ (mod p) and /= F(yA Ja» OP), 
solves the signing equation for kA (if kA=0, then choose another Ca) 

l = c/ + c/^ (mod?). 

Next CA computers K = H{{a^y) and *^=DESjt(A!4), then sends the 
5 triple (/^ . k^jA)^oA. 

3. ^ computes K^H{J3^),kA = DESic(^^), and a=kAk'^ (mod (if fl=7, then goes back 
to step 1.). Then checks if = aj^^ . Now a is ^'s private key, ju isA^s generator and 

is A *s public key. A publishes (a, Ia , A , P. g)iTi public domain. 

4. Anyone can obtain -4 's (ID-based) implicitly certified public key from the public 
1 0 domain by computing 

= ajT^ (mod p) 

Scheme 3.b: 

1 . A randomly chooses an integer k and computes , then sends it to CA, 
15 2, CA randomly chooses an integer ca , computes = >^a'^ (mod;?) and/= Fiju Ja. OP), 
solves the signing equation for kA (if kA=0, then choose another ca) 

l^ck^^cj (mod 9). 

Next CA computers K = //((/?* Y'' ^ ) = //(a*'^ ) and A^=DESjt(^^), then 

sends the triple {y^ , ^^,/^)t0y4. 

20 3. ^computes K^H{{yJ/3'f)^H{a'''),kA--T>E^i^k^\J^F{yAjA.0P)m 

a - kA'kf (mod g). (if a=0,I, then goes back to step 1.). Then checks if ^ -ccy'J • 

Now fl is ^'s private key, >^is A"s generator and P^ \%A"i public key. A publishes (a . 

lA,fiyA,p. q) in public domain. 
4. Anyone can obtain A ' s (ID-based) implicitly certified public key from the public 
25 domain by computing 

fi^ - ay"/ (mod/?) 

Note: (for scheme 3.b) 

1 . The identity I a may be chosen either by CA or by entity A 

2. CA should authenticate the entity A. It can be done either by presence in front of CA 
30 or by secure channel or by voice (for example, on the phone) or by following method: 
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In step 2, instead of sending the triple (/^ , Ia) to A, CA first sends to A. A 

computes K ^ H{(y^//J^y) = H{a^^), encrypts the authentication infonnation Aai 
of A (such as VISA information) by DES (or other symmetric key system) and sends 
DES/c(^^/) to CA. CA decrypts the DESic(i4x/) to get Aai . After checks the validity of 
5 Aai, CA then sends {/c^Ja) to ^. 

3- {/a ' ^a Ja) can be sent by public channel. 



Scheme 3.c: 

1. A randomly chooses an integer k and computes ot, then sends it to CA. 
10 2, CA randomly chooses an integer ca , computes = flr*ar^'' (mod p) and F^ju Ja, 
OP), computes kA (yikA^O, then choose another ca) 

kA s c/+ Ca (mod q). 
Next CA computers K = H{{a''y) and k ^=DES jcikA). then sends the triple 
i^A ' IcaJa) to A. 

15 3. A computes K^H(^), kA = DESic(*^), and 0=*^+/: (mod ^) (if fl=0,7, then goes 
back to step 1 ,) Then checks if a"" = fi^rA - Now a is ^4 's private key, a is ^ 's generator 

and a° is /i 's public key. A publishes {ajA. Xa, p, q) in public domain. 
4. Anyone can obtain A 's (ID-based) implicitly certified public key fi-om the public 
domain by computing 
20 oc'^P^Ya (modp) 

Scheme 3.d: 

1. A randomly chooses an integer k and computes ct^ then sends it to CA, 

2. CA randomly chooses an integer ca , computes = c^a^^ (mod p) and/= F{yA Ja* OF), 

25 computes kA (if then choose another Ca) 

kA^ CAf-k-c (mod q). 
Next CA computers K = H{{a^Y) and ^^=DES/c(^^), then sends the 
triple {rA>k^jA)XoA. 

3. A computes K^HiJ^) , = DESx(ikJ/=F(r^ , OP), and a^kA^hf (mod 9). (if 
30 fl=0,/. then goes back to step 1.). Then checks if or' = y^^fi. Now a is i4's private key. 
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aisA's generator and a" is A's public key. A publishes (ct,lA,A/A.p»4)^^ public 
domain. 

4. Anyone can obtain A 's (ID-based) implicitly certified public key from the public 
domain by computing 
5 cl'^^YaP (mod/?) 

Notes: (for scheme S.a, 3.c, 2.d) 

1 . The identity h may be chosen either by CA or by entity A 

2. CA should authenticate the entity ^4. It can be done either by presence in front of CA 
10 or by secure chaimel or by voice (for example, on the phone) or by following method: 

In step U A compute ct and K=H{jf \ then sends ct and DESi^>4^y) to CA. CA 
computes K = H{(c/Y) and decrypts the DESxiAj/) to get Aaj . After check the 
validity of AAh CA continues step 2. 

3. {y^ ,kA, Ia) can be sent by public channel. 

15 The advantages for scheme 3.a,3.c and 3.d are that user A can compute K easily since ^ is 
fixed and that is encrypted such that no other people can know it In fact the publicity of 
kA does not decrease the security of the certificate scheme. The purpose of encrypting is to 
make sure that the entity knows k. So for scheme 3.a-3.d, the DES encryption part can be 
removed and k^ can be replaced by kA provided the certificate scheme uses the method 

20 described in Note 2. 

To save transmission bandwidth in above schemes, we can modify above schemes by sending 
/= Fi/A J A. OP) in stead of (Note that in general, the size of is large than 160 bits and/ 
is just 160 bits.) Following scheme 4.c is a modification of scheme 3.c. 

25 

Scheme 4.c: 

1 . A randomly chooses an integer k and computes ct, then sends it to CA, 

2. CA randomly chooses an integer ca , computes y^ = a^a^"" (mod p) and /= F{yA Ja, 
OP), computes kA (if A:^=0. then choose another ca) 

30 kA^cf+CA (modg). 

Next C4 computers i: = //((<2r*)') and ^^=DES/c(/:^), then sends the triple 
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{f.kM to /I. 

3. A computes K = H{^), = DESj^^^), and fl=A:^+A (mod q) (if a^O,l, then goes 
back to step 1 .) Then computes - (f p'^ (mod p) and checks if / = F{yA Ja» OP). 
Now a isA's private key, aisA's generator and a" isA's public key. A publishes {a, 

5 Ia » /a , P» (j) public domain. 

4. Anyone can obtain y4's (ID-based) implicitly certified public key from the public 
domain by computing 

a''=>ffV. (mod/>) 
1 0 Furthermore we can reduce the bandwidth by following scheme 5.c. 
Scheme S.c: 

^ I. A randomly chooses an integer k and computes of, then sends it to CA. 

2. CA randomly chooses an integer ca , computes = or*^^'* (mod p) and set as (he 
15 first 80 least significant bits of y^ . Then computes f= Fiy^ Ja.OP) and kA (if A^=ft then 

choose another ca) 

kA^cf+CA (mod 9). 
Next CA computers K = (a*)^ (mod p) and *^=DESj^/u), then sends the triple 
(y,. kMtoA, 
20 Note: (/^ . k^iJA) can be sent by public channel. 

3. A computes /: = /?* (mod /?). kA = DES/K*^), and a=kA-^k (mod ^) (if ^=0,7, then 
goes back to step 1.) Then computes F{y^,fiJA) , = flr"^^ (mod p) and checks if 
the first 80 least significant bits of y^ is . Now aisA^s private key, ^ is ^4 *s generator 

and flr" is y4's public key. A publishes (or. , ^ ;}( , p, 9) in public domain. 
25 4. Anyone can obtain A 's (ID-based) implicitly certified public key from the public 
domain by computing 

zzfify^ (mod/7) 
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The security level of scheme 5.c is not as other schemes we discuss before. Scheme 5.c only 
has 80 bit security. But it is OK for practical application Now. We can extend the first 80 
least significant bits to the half least significant bits of . 

5 The implicit certificate can he used to certify some other usefiil infonnation by including the 
information in the option parameter OP. For example OP^a""^ \\OPi^ where at is user A's 
another private key and c^"^ is the corressponding public key. Following scheme 6.c is a 
modification of scheme 2.c. Other schemes can be modified in the same way . 

10 Scheme 6.c: 

1. A randomly chooses an integer and computes a!"^ , 

2. A randomly chooses an integer A and computes i/, then sends and lar'^Mo C4. 

3. CA randomly chooses an integer Ca , computes = a^a""^ (mod p) and/= Fij^A . h% 

a'^'.OPi) (for example, F{rA Ja, a^'.OPs) = K/a \\ IaWcc"')) , computes kA (if kA^O, 
1 5 then choose another Ca) 

kA s c/+ Ca (mod q). 
Then CA computers y\ = (ar*)"^ (mod p) and sends the triple {y\ ,kA,lA) to A, 

4. A computes a^kA-^k (mod q), (if a=0.7, then goes back to step 1.) and computes 
/a = irli)^ ' ^* ("^od p). Then checks if a" = jS^y^ . Now a is A's private signing key, 

20 a is A's generator and is ^ 's public signing key. as is A 's private encryption key and 
a"^ is A 's public encryption key. A publishes {a, a''^ Ja» A rA»P»4) ^^ public domain. 

5. Anyone can obtain w4's (ID-based) implicitly certified public key fi-om the public domain 
by computing 

a"" ^p^y^ (modp) 

25 

Notes: (for scheme 4.c, 5.c, 6,c) 

1 . The identity 1a may be chosen cither by CA or by entity A 

2. CA should authenticate the entity /i. It can be done by the method described in the note 2 
of scheme 3. c. 

30 (/". kj^lAi or (/^ . k^lAS or {y\ M I a) can be sent by public channel. 
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CA chaining scheme 

In order to implement a CA chaining structure. That is CAl authenticates CA2, CA2 
authenticates CA3 and CA3 authenticates user A. In this section, we are going to present the 
example with 3 CA's in the CA chain. We use basic scheme 3' to demonsUrate this example. 
5 System setup: 

The highest trusted party CAl selects an appropriate prime p with p-tq-^I where q is 
a large prime and a generator aof order g. CAl selects a random integer cj, with i^c/ Sg-l 
as its private key, then computes the public key a''' mod p and publishes (jSj. a, p. q). 

Phase 1. CA2 applies for implicit certified public key from CAl. 

1. CA2 randomly chooses an integer k} and computes a*' , then sends it to CAL 

2. CAl choose a unique distinguished name ox identity Iqai ai^d a random integer ccai 
with l<ccA2 ^q-1 . Then CAl computes Xcai =<ar**a''''" (mod /?). {ycA2 is CA2"s 
public key reconstruction public data.) 

3. CAl chooses a function// =^F(ycA2 Jca2) and computes kcA2 (if *C4i=ft then chooses 
another cc42 in step 2 and re-computes for kcA2y 

kcA2 - cfi + CCA2 (niod q) 

4. CAl computes /cm = (^*' )*^^' ("^^^ P) ^^^^^ ^"P^® ^^cai '^ca2, Ica2) to CA2, 

5. C42 computes rcAi^^rcAif' (modjp). Then C2=/:c42+^2 (mod 9) is C42's 
private key, a is CA2"s generator and fl}^ a^' is C42's public key. CA2 publishes (a 
. IcA2 . fih Ph rcA2 , p. q) in public domain. 
Note: when a user trusts CA2, he/she can use fi2 directly. 

6. Anyone can obtain C42*s (ID-based) implicitly verified public key from the public 
domain by computing 

Pi^cc''^M'YcAx (mod/?) 
Phase 2. CA3 applies for implicit certified public key from CA2. 
30 1. CAi randomly choose an integer ki and computes or** , then sends it to CA2. 
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2. CA2 choose a unique distinguished name or identity Icas and a random integer cca3 
with l^ccA3 ^q-L Then CA2 computes y^Ay ~ c^^cl^^ (mod p). (ptus is C43's public 
key reconstruction public data.) 

3. C42 chooses a function f2 =F{ftA3 Jcas) and computes Atcij (if kcA3=0, then chooses 
another cc^j in step 2 and re-computes for j)- 

kcA3^c^2-^ccA3 {modq) 

4. C42 computes /c^y = (or*')''''' (mod p) and sends the triple {/^^ ,kcA3. Ica3) to CA3. 

5. CAS computes =(/i:^3)*''^*' (niod p). Then cj^/tc^j+Ztj (mod q^) is CAS's 
private key, a is CA3*s generator and fi3-a^^ is C4J*s public key. CAi publishes (a 
, /c4j , y^2, P3, ycA3 , p. q) in public domain. 

Note: when an entity trusts CAS, it can use directly. 

6. Anyone can obtain CA3*s (ID-based) implicitly verified public key from the public 
domain by confuting 

P,^a''^fihcA^ (mod/)) 

Phase 3. User ^ applies for implicit certified public key from CAS. 

1. A randomly choose an integer k and computes , then sends it to CAS. 

2. CAS choose a unique distinguished name or identity Ia and a random integer ca with 
1^ Ca ^ q-L Then CAS computes y^^a'^a'^ (mod p\ (/a is A's public key 
reconstruction public data.) 

3. CAS choose a careful chosen function /j =F(yA Ja) and computes (if kA-0, then 
choose another c^ in step 2 and re-computes for Z:^). 

kA = c/j + (mod q) 

4. C43 computes =(^2^*)^'* (mod p) and sends the triple {y\ ,kA,lA)toA. 

5. i4 computes ;'^=(/i)* *^* (modp). Thenfl=A:4+* (mod 9) is /4's private key, oris 

i4's generator and fiA-ct^ is >4's public key. ^4 publishes {a, Ia . fih Pa. Ya . p» q) in 
public domain. 

Note: when a user trusts A, he/she can use Pa directly. 
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6. Anyone can obtain A's (ID-based) implicitly verified public key firom the public 
domain by computing 

A=^'=AV. (mod/;) 

S Phase 4. VserA's signature and verification. 

To sign a message M, user A does following: 

1 . randomly choose ;c, computes r=ci/^ (mod p). 

2. computes e=^fA-F{r,M), where F is some fixed function. 
10 3. computes (mod q) 

4. The signature on M is (r,^). 

Verifier does following: 

1 . gets CAl, CA2y CA3 and User A 's public data 

{aJcAiJcAi Ia. a. a a fiA. rcA2. YCAS, Ta . q) 

2. reconstructs user A 's public key 

3 . computes ~F{r,h4). 

4. computes r'= a' /T;* (mod/?) 

5. if r=r\ the signature is verified. At same time CAS and user y4's (DD-bases) 
public key are implicitly verified. 

Reconstructing user /I 's public key needs only 3 known basis exponentiation operations and 
3 multiplication operations. When the signature is valid, CA2, CAS and user -4 's (ID-bases) 
25 public key are implicitly verified. 
Notes: 

1 . If verifier trusts A, Then A 's public key is 

2. If verifier trusts CA3, Then A 's reconstruction public key is jff^ -^Ya P) 

3. If verifier trusts C42, Then A^s reconstruction public key is fi^ - fi('^'y{^yrA (™°^ 
30 p) 
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Co-signing Scheme. 

The following describes a scheme that allows multiple CA 's to sign ONE impUcit certificate. 
This is illustrated by the case where three CA 's co-sign a certificate using the basic scheme 
3'. 

5 System setup: 

Let CAl, CA2 and CA3 have a common system parameters : (1) prime p with 
' p-tq-^l where 9 is a large prime ; (2) a generator a of order q\ (3) a careful chosen 
function 

f-FirXhi+hi-^lAs))' CAl selects a random integer c/, with l<ci <q-l as its 
10 private key, then computes the public key fii^ tr'* mod p and publishes a, p, q), CAl 
selects a random integer C2, with 1<C2 <q'l as its private key, then computes the public key 
^2=0^'' mod p and publishes (^2. (X» p, 9). CA3 selects a random integer cj, with l^cs ^q-l 
as its private key, then computes the public key >^r= a''' mod p and publishes O^j, a, p. q). 

15 Step 1. A randomly chooses an integer k and computes a* , then sends it to CAl, 
CAl and CA3. 

Step 2. C4's exchange information and compute implicit certificates 
20 Phase 1. 

1. CAl chooses a unique distinguished name or identity Iai and a random integer cai 
with 1<Cai ^q-l , computes a''^' and send (or^" , Iai) to CAl, and CA3, 

2. CAl choose a unique distinguished name or identity 1^2 and a random integer Ca2 with 
25 l<CA2-^q'l , computes (a'"' Ja:) and send a''' to C4i and Cy4 5. 

3. CA3 choose a unique distinguished name or identity Ias and a random integer c^j with 
l<CA3^q'I , computes (a^'^^lAs) and send to C4i and C42. 

Phase 2. 

30 
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1 . CAl computes y = a^a^^'a^^^a^^ (mod /?). (/is A*s public key reconstruction public 
data.), computes f'=^F(rXhi^lA2'^lA3)) and computes Icai (if Icai^O. then goes back to 
phase 1.) 

kAi^C(f-^CAi (mod 9) 

C4i computes /i, =(a*)'^* (mod /;) and sends the triple (/J,, ,kAijAi)io A. 

2. CA2 computes y = a^a^^'a'^'^^a^^^ (mod p). (/is /4*s public key reconstruction public 
data.), computes/=F(/,(/^/+/^i+/4j)) and computes kA2 (if *:42==ft then goes back to 
phase 1 .) 

kA2 ^c/+ca2 (mod 9) 

C42 computes r^i-ia^Y^' (mod p) and sends the triple {/^^ .Ax2./w2)toA 

3. CAS computes / = a^a^^^a^^^a^°*^ (mod p), (/is A*s public key reconstruction public 
data,), computes /=F(/,(//4/+/^j+/-4i)) and computes kAj (if A^i=ft then goes back 
to phase 1 .) 

kA3 = c/+ cas (mod q) 

CA3 computes = (a^Y'' (mod p) and sends the triple (/^^ .A^j. /^j) to ^. 

Step 3 computes implicitly co-certified private keys and public key reconstruction 
infonnation. 

1. A computes a=A^;+Ji:^i+/:^j+A (mod q). (If a is 0 or 1, then goes back to step 1.) 

2. -4 computes / = (/i,/J,2/i3)* (mod/?), /=F(/(/^/+A42+/^i)). Then verifies if 

d^WMr (mod;?). 

3. Then a\^A"% implicitly co-certified private key, or is i4 's generator, Iai'^Ia2'^Ia3 is 
A's common ID and {PxPxP^^ Y is i4's implicitly co-certified public key. 

4. A publishes (a, Uh Ia2 , Us. fiu /h. A 7* P* 4) in public domain. 

5. Anyone can obtain i4's (ED-based) implicitly co-certified public key from the public 

domain by computing {fixfiifi^Y y (mod/?) 
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Applications 

The following examples are illustrated with respect to scheme 3 (or Scheme 7') as 
CA's signing equation since everyone shares the same generator in this scheme. Each us^ 
can have a different CA as long as the CAs use the system parameters (p,q,d) and each user 
S has the same generation. 

Setup: 

CAl : system parameters (a.^u PAA) 

Alice has a private key a, generator a and publishes (a, U, P, Ya, p. q) in the public 
10 domain. 

CA2: system parameters (a, P2, P,q) 

Bob has a private key b, a generator a and publishes (a, 1a, P, 7a, p, q) in the public 
domain. 

15 We use the MTI/CO key agreement protocol to demonstrate how to use our new scheme. 
Assxmie Alice and Bob want to perform a key exchange. 
The MTI/CO protocol 

I . Alice reconstructs Bob's public key a* = Z?^^^'*'* 1 and randomly chooses an 
integer x and computes (aV> then sends it to Bob. 
20 2. Bob reconstructs Alice's public key a" = Z?''^''^'''' , and randomly chooses an 
integer y and computes (a^)^, then sends it to Alice. 

3. Alice computes the shared key = (a'^)" ' -a"^ 

4. Bob computes the shared key = (a**)^* ' = a"^ 

This is a two-pass protocol. With the implicit certificate scheme of the present 
25 invention, each party only does three exponentiation operations to get the shared key while at 
the same time performing an authentication key agreement and implicit public key 
verification. 

The following are examples of signcryption schemes. We use scheme 3 (or scheme 7) as 
30 CA*s signing equation since everyone shares the same generator in this scheme. For the 
scheme thereafter, we use scheme 13 as CA's signing equation. For all schemes in this 
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section, each user can have a difTerent CA as long as the CA's use the same system 
parameters (p,q,a) and each user has the same generator. 

Setup: 

S CAl: system parameters (a, fii, p, q) 

Alice: private key a , generator or and {a,lA, Pu XA»P>g) in public domain. 
CA2: system parameters (a, J^,p,q) 

Bob : private key b , generator ^and (a, fii^Ys^P* <i) in public domain 
10 Bob wants to send a signed and encrypted message M to Alice: 



Signcryption Protocol 1: 

Assume Bob wants to send a signed and encrypted message M to Alice: 
Bob does following: 
15 1 . reconstructs Alice's public key a"" = fi^^"" mod p 

2. randomly chooses an integer x and computes a key v^^f (mod p) 

3. computes C=DESr(M) 

4. computes e=hash(C Ia) 

5 . computes s=be+x(mod q) 

20 6. sends the pair (C,s) to Alice, thus C is the encrypted message and s is the signature. 

To recover the message Alice does following: 

1 . computes e=hash(C U) 

2, reconstructs Bob's public key a* = niod p 
25 3 . computes a"(a*')*^'' (mod p) which is r 

4. decrypts the message M=DESr(C) 

5 . check for redundancy 

Thus, Bob only does two exponentiation operations and Alice docs three exponentiation 
operations. But AUce and Bob are both confident of each others authentication. Note that for 
30 this scheme, the message M must have some redundancy or pattern. 
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signcryption protocol 2 (general case): 
Setup: 

CAl: system parameters {a, fih p, q) 

Alice: private key a , generator a and {a,lA, fih rA,p,q) in public domain. 
5 CA2: system parameters {a, fiz. p, 4) 

Bob : private key b , generator a and (a, h. fii, n»P* 4) in public domain 

Note: this set up is for implicit certificate. For usual certificate scheme systems, we only 
required that Alice and Bob has same generator. 

10 

To signcrypt a message to Alice, Bob does following: 

1. gets Alice's public key cl^ (in the case of implicit certificate scheme, reconstructs 

Alice's public key a" = fi^^'''^'''^rj, (modp) ) 

2. random choose an integers and computes ^=(a*)' (mod;?) 
15 3. computes C=DESXAO 

4. computes e=hash(C| | cT) 

5. computes s—be-^x (mod <() 

6. sends (Cjt) to Alice. C is the encrypted message and s is the signature. 



20 To recover the message Alice does following: 

1 . computes e=hash(Cl | ot^ 

2. gets Bob's public key (in the case of implicit certificate scheme, reconstructs Bob's 
public key a' ^ fi/^''^-''^/^ (modp)) 

3. computes or" (or*)'" (mod p) which is r 
25 4. decrypts the message M=DES,(C) 

Note: 

1. If the certificate scheme is not the implicit certificate as described herein, Alice and 
Bob's public key should be verified. 

2. The message M must have some redundancy or pattern. 

30 3. Anyone who knows one value r can decrypt any messages fit>m Bob to AHce since the 
value (f^ will be exposed. 
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4. In general, we should include an option parameter to the hash e, i.e. e=hBsh(C\\cP\\OP). 
For example, or 0P^c/*\\j9i\\^. 

The signcryption schemes above have a drawback that if the signer lost his/her private 
signing key, then all message the signer signcrypted will be exposed to public. To protect 
post encryption we propose a new signcryption scheme. In new scheme, each user has two 
pairs of key, one pair is for signature key, another pair is encryption key. The new scheme 
can be used with any certificate scheme. But if it is used with our implicit certificate scheme , 
it is more efficient. 



Signcryption protocol 3 (general case): 
Setup: 

Alice: private signing key a and private encryption key a^, generator at and 
(a, a"' , Ia , A, /A ,p.q) in public domain. 
15 CA2: system parameters (a, p, q) 

Bob : private signing key b and private encryption key 6£, generator at and 
(a, a^^ Jb, fii. nfP.Q) in public domain 

Note: this set up is for implicit certificate using scheme 6.c. For usual certificate scheme 
20 systems, we only required that Alice and Bob has same generator. 

To signcrypt a message to Alice, Bob does following: 

1 gets Alice's public signing key ct and public encryption key or"* (in the case of 
implicit certificate scheme, reconstructs Alice's public signing key 

25 a'' = fi'^''^''"^'^y, (mod p) ) 

2 random choose an integer ;c and computes r=(a''a"* )' (mod p) 

3 computes C=DESr(AO 

4 computes e=hash(q|a^|| a""' \\o^\\ a'' \\0P) 

5 computes 5=6^+;c+6£ (modg) 

30 6 sends (Cj) to Alice. C is the encrypted message and s is the signature. 
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To recover the message Alice does following: 

1 . computes ^hash(C| | €f\\ a"' 1 1 c^\\ a'' \\OP) 

2. gets Bob*s public signing key of' and public encryption key a^^ (in the case of implicit 
certificate scheme, reconstructs Bob's public sign key a" = y?/^"^*''"^' V5 i^od 

5 p)) 

3. computes a^''^''^'ia^)-^''^'''^' d^-^"*'''^^^ (mod;?) which is r 

4. decrypts the message M=DESr(C) 



Note: 

10 1 . we can think the receiver Alice's private key is a+fl£, This means the receiver only 
needs one private key instead of two private keys. But the sender Bob needs two 
private keys. In case of normal certificate, the receiver only need one private key. 
2, If the certificate scheme is not the implicit certificate described in this application, 
Alice and Bob's public key should be verified. 

15 3. The message Mmust have some redundant or pattern. 

4. The parameter OP inside hash e^hashiCWefWa"' {{of'Wa^' \\0P) may be empty or 

op^m. 

5. Knowing one r value does not reveal any information of the post messages. 

6. With implicit certificate scheme. Bob only does 2 exponentiation operations and Alice 
20 does 4 exponentiation operations. But Alice and Bob both are confidential that each 

other is authentication part. 

7. If anyone knows Alice's private key a+fl£. or Bob lost both private keys, the post 
encrypted message can not be protected. 



25 For normal signatures, one problem is that the signer denies he/she signs the signature. This 
called repudiation. Protocol 1 and 2 above have a non-repudiation feature provided one 
trusts the judge. That is the signer can not deny that he/she signed the signcrypted message. 
Protocol 3 has a non-repudiation feature even when the judge is not trusted. Next protocol 
demonstrates how a judge decides a case where Bob wants to deny the signature. 

30 

Non-repudiation protocol: 

1 . Alice sends (C^) to Judge 
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2. Judge computes e=hash(C||fl^||a''' ll^^'ll^*' \\0P) and a' = a'{a'y' a'' (Note: 
Alice and Bob's two pairs of public key should be verified. In the case of implicit 
certificate scheme, the public keys should be computed fi-om the reconstruction public 
data.) 

J. Judge randomly chooses two integer r/ and and computes L = {a'Ya'^ and sends 
L to Alice 

4. Alice computes Z"*"* and sends it back to Judge 

5. Judge computes r = ' and recover the message by A/=DESr(C) 

6. If M has proper fonnat, the (C, j) must be signcrypted by Bob. 

7. After the judge make decision, he sends the values {cf, rj, r2, Z, U^''^ , r) to Alice and 
Bob to back up his decision. 

For the other two signcryption protocols the non-repudiation protocols are similar provided 
one fully trust the judge. 

In conclusion it may be seen that the present scheme, when combined with an 
application protocol for which the user's private key must be used directly in computation, 
provides an implicitly certified ID-based public key of the user. These schemes can also be 
used for a Key Authentication Center (KAC) to distribute implicitly certified public keys to 
users. 

A fiirther application of implicitly certified public keys is that the bit strength of the 
certifying authority is the same as the user or entity public keys being certified. By bit 
strength it is implied the relative key sizes and processing power of the entities concerned. 

One approach to addressing this issue is to embed implicitly certified public keys into 
more traditional certificate structures such as specified in X.509 certificates, where the 
signature on the certificate is at a higher bit strength than the implicitly certified public key. 
Hence, the CA has certified the user public key at two different security levels. Any other 
entity retrieving a public key can decide on which security level they wish to accept. In some 
applications it may be that only the lower level provided by the implicit value is necessary to 
provide the performance required. 

While the invention has been described in connection with specific embodiments 
thereof and in specific uses, various modifications thereof will occur to those skilled in the art 
without departing fi-om the spirit of the invention as set forth in the appended claims. For 
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example in the above description of preferred embodiments, use is made of multiplicative 
notation, however the method of the subject invention may be equally well described utilizing 
additive notation. It is well known for example that elliptic curve algorithm embodied in the 
ECDSA is equivalent of the DS A and that the elliptic curve analog of a discrete log logorithm 
S algorithm that is usually described in a setting of, the multiplicative group of the integers 
modulo a prime. There is a correspondence between the elements and operations of the 
group and the elliptic curve group £(Fq). Furthermore, this signature technique is equally 

well applicable to functions performed in a field defined over Fp andF^, . It is also to be 

noted that the DSA signature scheme described above is a specific instance of the ElGamal 
10 generalized signature scheme which is known in the art and thus the present techniques are 
applicable thereto. 
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THE EMBODIMENTS OF THE HWENTION IN WHICH AN EXCLUSIVE 
PROPERTY OR PRIVILEGE IS CLAIMED ARE DEHNED AS FOLLOWS: 

1 . A method of generating a public key in a secure digital communication system, 
having at 

least one trusted entity OA and subscriber entities A, said method comprising the steps of: 

(a) (a) for each entity A, said CA selecting a unique identity U distinguishing 
said 

entity A; 

(b) generating a public key reconstruction public data of entity A by 
mathematically combining a generator of said trusted party CA with a private value of 
said entity A, such that said pair (U, ) serves as A's implicit certificate; 

(c) combining said implicit certificate information (U, /a ) accordance with a 
mathematical function Y{y^ , U) to derive an entity information/; 

(d) generating a private key a of said entity A by signing said entity information/ 
and 

transmitting said private key a to said entity A, whereby said entity A's puWic key 
maybe reconstructed from said public information, said generator and said 
identity Ia relatively efficiently. 

2. A method of generating a public key certificates m a digital communication system, 
said method comprising the steps of: 

(a) (a) generating a public key certificate, according to a public key cryptographic 
algorithm; 

(b) embedding within said public key certificate a plurality of public key and 
wherein 

at least one of said public keys is an implicitly signed public key; and 

(c) pubUshing said certificate. 

3. . A method for generating a pubhc key certificate of a subscriber entity A by a trusted 

entity CA, said method comprising the steps of: 

a) selecting a unique identity infomiation Ia for said subscriber entity A; 

b) generating a private value Ca for said subscriber entity A; 
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c) generating a public value Ya for said entity A from said private value ca; 

d) using said public value Ya ^d said identity information U in a cryptographic function 
to generate a value f 

e) signing said value f to produce a signature a; and 

f) transmitting said signature a , public value Ya and said identity information Ia to said 
subscriber entity. 
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